62 LEXPERT MAGAZINE
|
OCTOBER 2017
ticularly in the EU where PNRs are seen
by privacy advocates as yet another massive
database that carries unacceptable risks of
infringements on human rights. Indeed,
the PNR agreement explicitly recognized
the competing consideration, stating that
its purpose was both to "ensure the security
and safety of the public" and "prescribe the
means by which the data is protected."
e ECJ took explicit objection to sev-
eral aspects of the proposed EU-Canada
agreement. In particular, the court found:
e words "all available contact infor-
mation" and "any information" were too
broad;
e basis for transferring sensitive infor-
mation required a "particularly solid justifi-
cation" that the agreement lacked;
Recent research suggested the automated
predictive algorithms used to process PNRs
might be subject to discriminatory bias;
ere was no need to retain the data once
passengers who presented no risk of terror-
ism or transnational crime before or during
their stay in Canada and had now le; and
e agreement did not provide for an in-
dependent supervisory authority empow-
ered to ensure that passengers whose PNR
data was used or retained be notified.
e decision does not, however, mean
that the agreement is dead in the water.
"While the opinion questions several
rules under the PNR system, it does not
question its raison d' être," Aylwin says. "In
other words, the EU-Canada agreement is
currently on the grey list, but it could still
take off."
Almost immediately aer the ruling, the
European Commission (EC) indicated that
it would seek to comply with the court's
ruling by way of further negotiation with
Canada. at negotiation could proceed
relatively smoothly from a Canadian per-
spective. "e court's reasons are not that
far removed from the principles underlying
Canadian privacy laws, in particular with
respect to necessity or transparency," Ayl-
win says.
Still, while the court's reasons are based
on the European Charter of Fundamen-
tal Rights, they underscore the challenges
facing any further efforts Canada and the
EU to collaborate on data transfer.
is is particularly so with the EU's
new General Data Protection Regulation
(GDPR) due to take effect in May 2018.
"e GDPR is much more comprehen-
sive than the current regulation," says pri-
vacy lawyer David Young of David Young
Law in Ottawa.
"When it comes into force, Canada will
again have to seek confirmation that its pri-
vacy laws comply with EU law in order for
Canadian businesses to transfer or receive
personal data from the EU."
Although the EC determined in 2001
that Canada's Personal Information Pro-
tection and Electronic Documents Act
provided "adequate protection" for data
transferred from the EU, it could revisit
that conclusion. Indeed, the ECJ noted in
a previous decision that the level of protec-
tion ensured by countries outside the EU is
liable to change and that "it is incumbent
upon the [Data Protection] Commission-
er" to periodically check whether an earlier
adequacy decision was still justified.
What the EC may find particularly ob-
jectionable is that Canadian law does not
prohibit the transfer of data to countries
lacking meaningful privacy regimes, mean-
ing that data transferred from the EU to
Canada could end up in those countries.
"All [Canada requires] is contractual
arrangements ensuring that Canadian re-
strictions will be largely honoured by the
entity that is receiving the data," says Mark
Hayes of Hayes eLaw LLP in Toronto.
THE EUROPEAN Court of Justice (ECJ)
has turned thumbs down on a proposed
agreement between the European Union
and Canada on the transfer and processing
of airlines' passenger name records (PNRs)
and associated data.
"e ECJ concluded that the transfer
and use of passenger name records as con-
templated in the proposed agreement was
incompatible with the respect for private
life and the protection of personal data
within the meaning of the Charter of Fun-
damental Rights of the European Union,"
says Antoine Aylwin of Fasken Martineau
DuMoulin LLP's privacy and information
protection group in Montréal.
e agreement would have allowed Can-
ada to keep PNRs for up to five years and
possibly share them with other non-EU
states. As the court saw it, that constituted
a valid purpose. Unfortunately, the agree-
ment was sufficiently lacking in particular-
ity to render it an "interference with the
fundamental right to respect private life."
PNR lists have existed since the Inter-
national Air Transport Association was
founded in 1945. Oen cited as important
tools in the fight against terrorism, the use
of PNRs has become controversial, par-
Canada will again have to seek confirmation that its privacy laws comply with new EU legislation BY JULIUS MELNITZER
ECJ rules on transfer of airline records
PHOTO:
SHUTTERSTOCK
| PRIVACY LAW |
THE BORDER
